Privacy policy.

1. Data Collection & Security

We never store the name, A-Number or mailing address from your case. When you paste your JSON/API data into our analyzer, it is processed in real time to write your report. If you share with the community (on by default; you can turn it off), we also keep a de-identified copy of that case data: names, A-Numbers, addresses and other personal details removed, and every full receipt number cut to its first 8 characters. We build the community timelines from it; turning sharing off stops new contributions, and the copies we can link to you are deleted (Section 5). (Separately, we hold your case data briefly, de-identified and encrypted, to deliver a report you pay for — see below.) From that copy we keep de-identified case milestones — status codes and dates, your form type, and your service center — to power the community timeline benchmarks everyone relies on. In that community data your receipt number is kept only as a keyed one-way hash and its 8-character block prefix (Section 2 explains every place your receipt number is used), and sensitive identifiers — your Alien Registration Number (A-Number), applicant name, and mailing address — are never written to our database. You can opt out at any time and delete the contributions we can link to you (see Section 5).

Saved analyses — so you can return to your results. When you purchase an analysis, we save the analysis we generate for you (not your raw filing) so you can reopen your results later without re-pasting everything — for example, from the link in your receipt email. This saved copy is tied to your purchase, retrievable only through a private, non-guessable link, automatically deleted after 90 days, and you can delete it yourself at any time from the results screen (or by contacting us). We minimize what it contains and never include your A-Number or applicant name.

Your case history (My Case). When you get a paid report, or share a case with the community while signed in, we save a snapshot of that case under your email (your account's, or the one you paid with): its form type, service center and office, status, its steps with their dates, and the other case details in USCIS's status data, such as whether the case is closed. A snapshot of a case you share also keeps your report's timeline. A new snapshot is added only when the case has changed. My Case shows these snapshots only to you, when you sign in with that email. We also use them to tell you what changed since your last check, to count the reports you have run if you ask for a refund within 7 days (see our Terms), and, for Premium members, to send the case alerts described in Section 3. This history is saved whether or not you share with the community. In it, your receipt number is kept only as a keyed one-way hash, any receipt number in USCIS's text is cut to its 8-character block prefix, and we leave out names, A-Numbers and addresses. It is kept until you delete your account, which you can do at any time from your Account page, or until you ask us to delete it at info@casestatusapi.com. Buying a report or a plan makes an account for the email you paid with (no password): sign in with that email to see it or delete it.

Delivering a report you pay for. When you start a checkout, we hold the case data you are paying to have analyzed so we can deliver your report even if your browser loses it (for example in an in-app browser, or if you finish on another device). Before storing it we remove personal details — names, dates of birth, addresses, contact details, A-Numbers, your representative's name, and the names of files you uploaded — and we encrypt what remains with a key that is not kept in our database. It is deleted as soon as your report is ready, and within 24 hours if the checkout is not completed.

Your IP address. We do not store it. To limit spam on the forum (one post an hour, one reply every five minutes) and to count clicks on referral links, we keep only a keyed one-way hash of it, which cannot be turned back into the address.

2. Your USCIS Receipt Number

USCIS considers your receipt number (for example, IOE0912345678) personally identifiable information, and so do we. This section explains how we use it to get your case status, where it is kept, and how we protect it.

How we use it

• To get your case status. We use your receipt number to build the links to your own case on my.uscis.gov, which open in your browser while you are signed in to your own USCIS account.
• To write your report. We read the case data you give us (pasted, or sent by our iPhone Shortcut or Chrome extension), which includes your receipt number, to build your timeline and report. To write the report, that case data is processed by Anthropic, or by OpenAI when Anthropic is unavailable, as our service providers (Section 6), after your name, A-Number, address and other personal details are removed and every receipt number is replaced with a placeholder (such as IOE09123-R1), so the AI never sees your receipt number; we put the real number back into your report ourselves. The same applies to questions you ask about your case. Screenshots you upload are the one exception: OpenAI's AI reads the image itself. Nothing is used to train their models.
• To keep a purchase tied to its case. A one-time report is linked to its case by a keyed one-way hash of the receipt number, never the number itself.
• For your case history. The same keyed hash links the snapshots in My Case to their case, so a later check can be compared with the last one (Section 1).
• For community timelines and alerts. Only the first 8 characters (the “receipt block”, which about 100,000 cases share) and the keyed hash are used, to compare cases filed around the same time and, for Premium members, to send alerts about activity in their block.

We never sell receipt numbers, never use them for advertising or marketing, never use them to look up a case you didn't ask about, and never share them with anyone other than the service providers that need them to deliver your report.

Where it is kept, and for how long

• Community data: never the full number, only the keyed hash and the 8-character block prefix (Section 5).
• Your case history (My Case): never the full number, only the keyed hash and the 8-character block prefix. It is kept until you delete your account (Section 1).
• Your saved report (if you buy one) shows your receipt number so you can recognize it. It opens only through a private, non-guessable link, is deleted automatically after 90 days, and you can delete it sooner.
• Checkout hold: the case data you are paying to have analyzed is encrypted (AES-256-GCM) with a key that is not stored in our database, and deleted as soon as your report is ready, or within 24 hours if the checkout is not completed.
• iPhone Shortcut hand-off: held for at most 10 minutes, only to pass your case data from your phone to your browser, then deleted.
• Screenshot readings: if you upload a screenshot, the text we read from it is kept for up to 24 hours so your report can use it, then deleted.
• USCIS Case Status API results are handled the same way as case data you paste: shown to you, and kept only as described here.
• Your own device: the site may keep your case data in your browser's storage so you don't have to paste it again. It stays on your device.

How we protect it

• Everything sent between your device, our servers, USCIS and our service providers is encrypted in transit (HTTPS/TLS).
• Our database is encrypted at rest, is not publicly readable, and is reached only by our own servers using restricted credentials. Our USCIS API credentials are kept as server secrets, never in the app or your browser.
• We do not write receipt numbers to our server logs, and the parts of our pages that show your case data are hidden from the Microsoft Clarity session recordings described in Section 6.
• Only the people who run and support the service can access our systems, and only as needed to do so.
• If a receipt number is ever exposed in a data breach, we will notify you as described in Section 11.

To have us delete anything tied to your receipt number, email info@casestatusapi.com. We complete requests within 30 days.

3. Account & Subscription Data

If you subscribe to our monthly plan or make a one-time purchase, we store only the following account information to manage your subscription. Buying a report or a plan makes an account for the email you paid with; you sign in with a code we email to it, and you can change that email or delete the account on your Account page:

• Email address — used to identify your account and check subscription status.
• Subscription status — whether your plan is active, canceled, or past due.
• Stripe customer ID and subscription ID — used to link your account to Stripe for billing management.
• Case alerts (Premium members) — if you have cases saved in My Case, we may email you, at most once a week, when other cases with the same form in your receipt block get USCIS updates. We keep a record of which alerts we sent so we don't repeat them; it is deleted with your account. Every alert has a link to stop them.

We never store your credit card details. All payment information is handled securely by Stripe. Aside from the saved analysis and the case history described in Section 1, which you can delete, your billing data and your case data are kept separate.

4. Local Storage & Cookies

We use strictly necessary cookies and local browser storage to provide core site functionality, maintain security, and prevent the abuse of promotional offers.

To improve your experience, we use your browser's Local Storage to remember your email for subscription status checks and to prevent repeated promotional discount popups once claimed. Analysis results may be temporarily stored in Session Storage on your device during your visit. This data stays on your computer and is never uploaded to us.

We also use Google Analytics and Google Tag Manager (cookies) to track anonymous usage statistics (e.g., page views) to help us improve the website. When we test two versions of a page, your browser's Local Storage also remembers which version you were shown (a random label such as “control”, with no personal data), so you see the same one each visit. We include that label with these statistics and, if you buy, with your order, so we can compare the two versions.

Advertising. Our public reading pages (guides, status-code explanations, form trackers and our USCIS API explainer) may show ads from Google AdSense, clearly labelled “Advertisement”. These ads are non-personalized: Google chooses them from the page you are reading, not from your browsing history or a profile of you. To show them, Google receives the technical information any website visit sends (such as your IP address, browser and the page address) and may use cookies or similar identifiers to limit how often you see an ad, prevent fraud and measure results, under Google's advertising policies. We never show ads on pages where you enter or view case data (the home page checker, the free tracker, your report and shared reports), on pricing, checkout or account pages, or to anyone signed in to an account, and we never send your receipt number, case data, email or account details to Google or any advertiser.

5. Community Milestone Data & Cryptographic Anonymization

To help the broader immigration community benchmark realistic USCIS processing timelines, CaseStatusAPI contributes de-identified case milestones by default. This data carries no information that identifies you or your case, and you can opt out at any time and delete the contributions we can link to you.

• On by Default, Anonymized — Opt Out Anytime: De-identified milestones are contributed automatically so every applicant benefits from the shared benchmark. It is de-identified: it carries no name, A-Number, address or full receipt number — and you can opt out at any time, and delete the contributions we can link to you.
• Keyed One-Way Hashing: When contributing, your receipt number is converted into a keyed one-way hash (HMAC-SHA-256 with a secret key kept outside our database). Only its 8-character block prefix is kept readable, and full receipt numbers inside USCIS's own text are cut to that prefix too. The community data never contains a full receipt number.
• Zero Personal Identifiers (PII): We strictly strip and discard all applicant names, Alien Registration Numbers (A-Numbers), birth dates, postal addresses, phone numbers, mail tracking numbers, and payment information.
• Milestone-Only Telemetry: Only high-level timeline metadata (Form type, Service Center/Field Office, and milestone transition timestamps) is collected to compute community velocity metrics.
• Revocation & Deletion: You can turn sharing off at any time (“Turn off” under your results, or Opt Out on your Account or Insights page), which stops new contributions. Opt Out also deletes the copies we can link to you: those shared from your device or linked to your account. A copy saved automatically carries no name, email or link to your account, so we can't find it from your account; to have it removed, email us the case's receipt number (Section 2).

6. Third-Party Services

Stripe: We use Stripe for payment and subscription processing. Your payment information is handled entirely by Stripe securely; we never see or store your credit card details. When your last subscription ends, or when you delete your account, we ask Stripe to remove your saved card; Stripe keeps its record of past payments. See Stripe's Privacy Policy.

Anthropic and OpenAI: We use Anthropic's API to write the case insights and answers, and OpenAI's API as a backup when Anthropic is unavailable, to read screenshots you upload, and to match questions with community posts. Personal details are removed and receipt numbers are replaced with placeholders before anything is sent (Section 2), except in screenshots. Data sent to either is subject to their API privacy terms and is not used to train their models.

Supabase: We use Supabase to securely store your account and subscription information (email, subscription status) and the case data described in Sections 1, 2 and 5: de-identified community milestones, and, for your own use, the reports you buy and the case history shown in My Case. Names, A-Numbers and addresses are never stored.

Microsoft Clarity: We use Microsoft Clarity to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. The parts of our pages that show your case data (your receipt number, pasted responses, case details and reports) are hidden, so recordings never contain them. On every page, Clarity also hides anything you type into a form and any numbers or email addresses. We don't use Clarity for visitors we locate in California, or when we can't tell where a visitor is. By using our site, you agree that we and Microsoft can collect and use this data. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

7. Data Retention

Your subscription account data is retained as long as your account is active. If you cancel, we may keep a minimal record so you can reactivate later. We keep account data only as long as it is needed for the purposes described in this policy, and we remove or de-identify it when it is no longer needed. You can delete your account and its data yourself at any time from your Account page, or by emailing info@casestatusapi.com. Self-service deletion is immediate; email requests are completed within 30 days. Records of past report deliveries stay without your email, so our purchase counts stay right. If you told us not to send you case alerts or offers, we keep only that choice and your email address, so we don't email you again.

Case data held for a checkout (Section 1) is deleted once your report is ready, and within 24 hours if the checkout is not completed. Saved analyses are automatically deleted 90 days after they are created. Your case history (My Case, Section 1) is kept until you delete your account or ask us to delete it. You can delete a saved analysis immediately from the results screen, or, when signed in, delete all saved analyses tied to your account. Optional community milestone data (Section 5) is anonymized and retained to compute aggregate trends; you can opt out at any time.

8. Categories of Data We Collect (and What We Never Collect)

We practice data minimization and collect only what the service needs:

• Account data: your email address and your subscription or purchase status.
• Billing data: a Stripe customer and subscription ID. We never see or store your card number.
• Receipt numbers: used and kept only as described in Section 2.
• Your case history (My Case): snapshots of the cases you get paid reports for, linked to your email, as described in Section 1.
• De-identified case milestones: your form type, service center, event codes, and status dates, plus a keyed one-way hash of your receipt number. It carries no name, A-Number, address or full receipt number.
• Website usage data: anonymous analytics and product-improvement metrics, including page views and interaction data such as heatmaps and session replay, through Google Analytics and Microsoft Clarity.
• Reviews you choose to leave: your star rating, any comment you write, and your report's form type. We publish a review only if you allow it, and then only with the name you choose to show (or "Verified customer"). A review is linked to your purchase only so we can mark it as verified. Reviews are optional, and we delete one when you ask.
• Notes on parts of a report: if you mark part of your report as not useful and write what was missing, we keep your note, which part it was about and your report's form type. Receipt numbers in the note are shortened and email addresses are removed before we store it, and the note is not linked to your account or purchase.

We do not collect, and we ask you never to submit, the following:

• Precise geolocation data.
• Financial account information, such as bank or card numbers.
• Medical, health, or biometric information.
• Your device contacts, call logs, or messages.
• Your Alien Registration Number (A-Number), full name, date of birth, phone number, or mailing address. If any of these appear in data you paste, they are stripped and never written to our database.

9. How We Share Your Data, and Your Choices

We do not sell your personal information. We have never sold it, and we do not share it for money, for targeted advertising, or for any other company's independent use.

The ads on our public reading pages are the one place another company receives information from your visit directly: Google receives the technical information described in Section 4 to show non-personalized ads. It never receives your case data, receipt number, email or account details, and signed-in visitors never see ads.

We share data only with the service providers that make the product work — the same providers named in Section 6 — and only so they can perform that work for us. These providers are bound by contract to protect your data, to use it only to provide their service to us, and not to disclose it or use it for their own purposes. We do not permit any third party to use or disclose your information — including de-identified, anonymized, or pseudonymized data — for any reason without your consent, except where the law requires it.

Your choices. Contributing de-identified community milestones (Section 5) is your choice. Every time you check a case, a line under your results says so, with a “Turn off” link; you can change your answer at any time there or from your Account or the Insights page. Turning it off stops future contributions from that device, and from your account if you are signed in. The Opt Out button on your Account or Insights page also deletes the timelines you contributed that we can link to you (Section 5). The benefit of contributing is more accurate community processing-time benchmarks for everyone. Because the contribution is de-identified — no name, A-Number, or readable receipt number — the risk to you is minimal. We do not collect genetic, family-history, or relatives' information, so sharing your milestones cannot reveal anything about other people.

10. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to access a copy of it, to ask us to correct or delete it, and to opt out of its sale or sharing. Because we do not sell or share your personal information, there is nothing for you to opt out of. We will never treat you differently for exercising these rights.

Do Not Sell or Share My Personal Information: we do not sell or share your personal information. To make any privacy request, email info@casestatusapi.com. We will respond within the time the law allows, generally 45 days.

11. Data Breach Notification

If we discover a data breach that affects your personal information, we will notify you without undue delay, consistent with applicable law. Our notice will explain what happened, what information was involved, and the steps you can take to protect yourself.

12. Closing Your Account

You can close your account at any time. From your Account page, the "Delete account" control removes your account and its data immediately, cancels any active subscription for you and removes your saved card. You can also email info@casestatusapi.com to request deletion, which we complete within 30 days.

13. Business Transfers & Change of Ownership

If our business is sold, merged, or transferred, we will require the new owner to honor a privacy policy at least as protective as this one. We will notify you of any change of ownership before your data becomes subject to a different policy, and you may delete or export your data before the transfer takes effect.

14. Changes to This Policy

If we make a material change to this policy or to how we handle your data, we will not apply it silently. We will notify you, give you a plain-language summary of what changed, and ask for your active consent before the change takes effect for your account. Minor, non-material edits are reflected by updating the "Last Updated" date at the top of this page.

15. Children's Privacy

CaseStatusAPI is a general-audience service for adults handling their own or their family's immigration cases. It is not directed to children under 13, and we do not knowingly collect personal information from them. You must be at least 18 years old (or the age of majority where you live) to buy a report or plan. If you believe a child under 13 has given us personal information, email info@casestatusapi.com and we will delete it.

16. Contact Us

If you have any questions about this Privacy Policy or wish to request deletion of your data, please contact us at info@casestatusapi.com.

Operated by ComplyWhiz LLC.